Patch PHP2Shell on a VPS: Check, Update & Verify
Here’s a sentence nobody running a VPS wants to read: your PHP version might let a complete stranger run code on your server, without a username, without a password, and before your website’s code even starts. That’s what happened on October 21, 2026, when the PHP project shipped an emergency release for two critical flaws nicknamed PHP2Shell. If you manage your own VPS, nobody is going to patch this for you. This guide shows you how to patch PHP2Shell on a VPS, confirm the fix actually took, and spot the signs that someone got in first. Updating WordPress won’t save you. Updating plugins won’t save you. The bug is in PHP itself — the runtime underneath WordPress, Joomla, Drupal, Magento, and Laravel. The only fix is a newer PHP, or a vendor package that backports the fix. The good news: checking takes two minutes, and patching is usually one package update plus a restart. On this page What happened in October 2026 What PHP2Shell actually is Who is at risk (and who is not) Check if your VPS is affected in 2 minutes How to patch PHP2Shell on a VPS: Ubuntu and Debian Patching on RHEL, panels, and Docker The stopgaps that are not a fix Verify the patch actually took The third flaw: CVE-2026-115560 Signs your server was already hit FAQ The bottom line What happened in October 2026 The PHP security team had planned a coordinated disclosure for Wednesday, October 21, 2026, at 14:00 UTC, for two critical vulnerabilities, both rated CVSS v4.0 9.2. Then details leaked early — a post on Hacker News described two remote code execution flaws, and exploit code calling itself PHP2Shell started circulating before the embargo lifted. PHP shipped the emergency fixes on October 21 anyway: PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35, with an advisory urging all PHP users to update immediately. The story kept moving. On October 23, PHP disclosed a third, related session-handling flaw, CVE-2026-115560, which the October 21 releases do not fix. By October 26, researchers at Trail of Bits said they had confirmed PHP2Shell exploits working against pre-patch PHP 8.2 through 8.5. As of October 28, Wordfence — which protects over 5 million WordPress sites — reported ongoing scanning and exploitation attempts across its network, while noting it was not aware of any confirmed WordPress compromise through PHP2Shell at that point. No confirmed compromises yet does not mean nobody is trying. It means the window for unpatched servers is still open. On shared and managed hosting, your provider patches PHP — Hostinger, GoDaddy, and others announced patched managed fleets on October 22–23, and you should still confirm on your provider’s status page. On an unmanaged VPS, there is no provider patching your PHP. That job is yours, your developer’s, or your sysadmin’s. Nobody else is coming. What PHP2Shell actually is: two CVEs, one nickname PHP2Shell is not an official PHP project name — it’s the name the security community gave to the leaked exploit tool, and it stuck. Underneath it are two distinct bugs in PHP core. Both allow unauthenticated remote code execution, both are rated 9.2, and both live in the interpreter itself, not in any framework or CMS. That’s why no application update can fix them. CVE What goes wrong CVSS v4.0 CVE-2026-109618 RCE via out-of-memory corruption: when PHP runs out of memory mid-request, cleanup can treat partially initialised internal request data as valid 9.2 (Critical) CVE-2026-109619 RCE via stale global state: internal state tied to a request can survive after its memory is freed, and a later request on the same worker can use it before it is reset 9.2 (Critical) CVE-2026-109619 is the easier one to picture. PHP has a session upload progress feature, enabled by default since PHP 5.4, that lets a browser track a file upload. When a multipart POST request contains a PHP_SESSION_UPLOAD_PROGRESS field, PHP’s session handler processes it while parsing the upload — before your application script runs at all. An attacker who can send a crafted multipart request to any PHP endpoint can reach that early, pre-application code path with no credentials, and end up executing code as the PHP worker user. CVE-2026-109618 is about what happens when memory runs out at exactly the wrong moment during request setup. You don’t need the memory internals to act on it — just this: neither bug cares what CMS you run, how strong your login page is, or how tidy your firewall looks. If PHP serves web requests on that box and the build is older than the fixed releases, the box is in scope. One warning: exploit code claiming to demonstrate these flaws is circulating publicly, and researchers have warned that unverified exploit code is sometimes laced with malware. Don’t download and run random “php2shell” tools to “test” your server. Check your version, patch, and verify — that tells you everything a PoC would, without handing your server to a stranger’s payload. Who is at risk (and who is not) The PHP project’s advisory puts it simply: all PHP installations serving web requests are at risk. The risk is not identical everywhere — PHP says it is highest for Apache with mod_php, where it describes a demonstrated exploit that fires before any application code runs — but every common way of serving PHP is in scope. How PHP runs At risk? Notes Apache + mod_php Yes — highest risk Demonstrated exploit fires during request startup, before app code PHP-FPM (Nginx / Apache) Yes Session upload progress RCE validated against FPM; restart workers after patching php-cgi, FrankenPHP, LiteSpeed (LSAPI) Yes Patch every SAPI on the box, not just the one you think you use PHP CLI / cron only, no web requests Lower Advisory targets web-serving installs; still patch No PHP at all (pure Node.js, Go, static) No Unless a forgotten PHP install hides on the same box — check, don’t assume That last row catches more people than you’d think. Plenty of “Node.js-only” servers still run PHP somewhere: a leftover
Patch PHP2Shell on a VPS: Check, Update & Verify Read More »
